Attachment 222522 Details for Bug 127813 – the patch

[patch] the patch

blah.patch (text/plain), 2.25 KB, created by Filip Pizlo on 2014-01-28 16:00:22 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2014-01-28 16:00:22 PST

Size: 2.25 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 162977)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2014-01-28  Filip Pizlo  <fpizlo@apple.com>
>+
>+        DFG ArrayPop double array mishandles the NaN hole installation
>+        https://bugs.webkit.org/show_bug.cgi?id=127813
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * tests/stress/array-pop-double-hole.js: Added.
>+        (foo):
>+
> 2014-01-28  Filip Pizlo  <fpizlo@apple.com>
> 
>         FTL should support ArrayPush
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 162977)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -3302,7 +3302,7 @@ void SpeculativeJIT::compile(Node* node)
>                 // FIXME: This would not have to be here if changing the publicLength also zeroed the values between the old
>                 // length and the new length.
>                 m_jit.store64(
>-                MacroAssembler::TrustedImm64((int64_t)0), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
>+                    MacroAssembler::TrustedImm64(bitwise_cast<int64_t>(QNaN)), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
>                 slowCase = m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, tempFPR, tempFPR);
>                 boxDouble(tempFPR, valueGPR);
>             } else {
>Index: Source/JavaScriptCore/tests/stress/array-pop-double-hole.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/array-pop-double-hole.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/array-pop-double-hole.js	(working copy)
>@@ -0,0 +1,14 @@
>+function foo() {
>+    var array = [1.5, 2, 3.5];
>+    array.pop();
>+    array[3] = 4.5;
>+    return array;
>+}
>+
>+noInline(foo);
>+
>+for (var i = 0; i < 100000; ++i) {
>+    var result = foo();
>+    if (result.toString() != "1.5,2,,4.5")
>+        throw "Error: bad result: " + result;
>+}

Actions: View | Formatted Diff | Diff

Attachments on bug 127813: 222522 | 222538 | 222539